1. Chapter 16: Risk Management Planning
Project Management
Chapter 16: Risk Management Planning

2. Project Risk Management
Definition and Importance
Four ways to handle risks
Risk Management Processes
Plan Risk Management
Identify Risks
Evaluate Risks
Plan Risk Responses
Project Risk by Phases

3. Project Risk Definition
Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives such as scope, schedule, cost and quality
A risk may have
one or more causes
one or more impacts
Source: PMBOK 5th Edition.

4. Project risk
More than the sum of the identified risks—there’s an overarching risk as well

5. What can be done about risks?
Avoid
Use another method
Don’t perform the risky activity
Transfer
Share or transfer the impact
Insurance is a major approach used here
Mitigate
Reduce probability of an impact
Reduce degree of potential impact
Accept
The activity is necessary and you cannot think of any cost-effective ways to mitigate the potential impacts of the risk

6. Example
Before paint can be applied, the surface must be cleaned. Toxic chemicals are one method of cleaning. Risk: someone may injure their skin or their eyes due to a spill or splash of the chemical. Options:
Avoid:
find another method of cleaning—would high-pressure water work as well? Could a longer delay for curing be considered? Is painting really necessary?
Transfer:
get insurance on the workers; if toxic exposure is based on time limits, use a larger workforce for shorter each. (An unethical method sometimes used: outsource internationally)
Reduce the probability of injury:
require protective equipment such as clothing and safety goggles and mask; provide training and information to the workers.
Reduce the degree or impact of possible injury:
ensure that onsite first aid attendants are available; eyewash stations, etc.
Accept: do nothing

7. More definitions Risk Appetite Risk tolerance Risk threshold
Degree of uncertainty an entity is willing to take on in anticipation of a reward
Risk tolerance
The degree, amount, or volume of risk that an organization or individual with will withstand
Risk threshold
Point above which a stakeholder or organization is no longer willing to accept the level of uncertainty or impact

8. Example
Think about Northern Gateway, a proposed oil pipeline in northern British Columbia
Risk appetite may be greater for the stakeholders who anticipate personal gain, or who value economic benefits more highly
Risk tolerance and threshold may be very low for those concerned about impact on wildlife, particularly if they do not see the value of the anticipated benefits in economic activity.
On a personal level
Is there any level of uncertainty you will accept for your child’s safety?
Note that there are also risks for “do nothing”

9. Plan Risk Management (process)
Make an overall plan of how the project will identify, track an respond to risks
Inputs:
Project plan, project charter, shareholder register, enterprise environmental factors, organizational process assets
Tools:
Analytical techniques
Expert judgment
Meetings
Outputs
Risk Management Plan
(note that this becomes input to the other four risk management processes: Identify Risks, Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis, Plan Risk Responses)
Comment:
The complexity of the Risk Management Plan will vary with the complexity of the overall project.

10. Identify Risks (process)
Inputs
Most of the other documents you already have regarding the project
Enterprise environmental factors and Organizational Process Assets
Tools and Techniques
Fact finding: Documentation reviews, etc.
Risk Breakdown Structure
Diagramming techniques
SWOT
Expert judgment
Outputs
Risk Register

11. Risk Breakdown Structure
Groups and categorizes risks
Identifies Response (Mitigation)

12. Risk Breakdown Structure Example

13. Risk Register List of identified Risks List of potential Responses
Over the life of the project will add:
Updates to probabilities of the risk occurring
Information on occurrences, if any
Information on actual responses and the success or lack of success of those responses

14. Qualitative Risk Analysis
Should always be done
Considers what are the risks, what can be done about them
Categorization of risks
Urgency of risks
May vary through the project;
Most concern for imminent risks
at some point a risk may no longer be an issue
Updates the risk register:
New information about risk probability and impacts
New rankings or scores
New assumptions

15. Probability and Impact Matrix

16. Probability and Impact Matrix
Place identified risks on the matrix
The closer to top-right, more important to try to identify how to move down and/or to the left.

17. Quantitative Risk Analysis
Quantitative Risk Analysis attempts to use published data to quantify the risks:
Industry data about probabilities
Data about typical costs
Uses a variety of tools
Data gathering
Sensitivity Analysis
Expected monetary value analysis
Modeling and simulation
Expert judgment
May be expensive; usually is cost-justified for large, complex projects
May NOT be cost-justified on smaller projects
Would also update the risk register with the new information

18. In-class activity
Consider a major proposed project locally, the replacement of the Patullo Bridge
With your group, identify at least ten things that could happen to impact the success of a bridge replacement project. Place each of the ten items on your Probability and Impact Matrix.
On another colour of post-it, identify things that could be done about the risk. Draw an arrow toward “reduced probability” or “reduced impact” or both.
Be ready to explain to the instructor or to members of another group, and at that point, if your explanation is accepted, you may MOVE your risk to the left or DOWN.
Get a group member to take a photo of your matrix to post to the class website.

19. Controlling Risks
Throughout the project, the project manager must continue to update the risk register, as new risks are identified, and the project retires consideration of risks that are no longer possible.
Risk reassessments and risk audits can be used to monitor and control the risk management processes.
There are costs associated with the contingency reserve, so if it can be identified that some portion of this reserve can be released, it is a benefit to the organization and to the project.

20. Project Change Management
Identification of a risk or occurrence of a risk may create a need for a Project Change.
Change Management is part of the Project Integration Management knowledge group
Reminder of a typical change management process:
Identify a change request
Consider the impacts and costs (may have a committee for this)
Make a decision
Identify what plans must be updated
Inform affected stakeholders of the decision
Proceed
The PMO may have forms and template procedures available for project use

21. Risk throughout the project
The levels of risk change throughout the project
The risk-over-time profile may be typical to certain project types:
Early for projects that use new technology
Late for politically sensitive projects
During procurement where this is a large portion of the budget

22. Risk Management -- Summary
Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives such as scope, schedule, cost and quality
A risk may have
one or more causes
one or more impacts
continued on next slide

23. Risk Management – Summary continued
Risk Management Processes
Plan Risk Management
Identify Risks
Perform Qualitative Risk Analysis
Perform Quantitative Risk Analysis
Plan Risk Responses
Control Risks

24. Project Risk Management (PMBOK 5)
Risk Management Process in the Planning Process Group
Plan Risk Management
Identify Risks
Perform Qualitative Risk Analysis
Perform Quantitative Risk Analysis
Plan Risk Responses
Risk Management Processes in the Monitoring and Controlling Process Group
Control Risks

25. Questions?